DEA Schedule II-V workflow + CSOS, how does it work in Magento?

Controlled-substance ordering has the strictest compliance burden in vet supply. Different rules per Schedule:

• Schedule II (most restrictive, ketamine, fentanyl, pentobarbital for euthanasia), requires DEA Form 222 OR a digitally-signed CSOS order. CSOS (Controlled Substances Ordering System) is the digital path, mandatory in practice for any volume.
• Schedule III-V (buprenorphine, butorphanol, tramadol, diazepam), less strict but still requires DEA-registered buyer, audit trail with retention, and Schedule-specific reporting.

Magento integration pattern: customer’s DEA number validated against the DEA CSAT (Controlled Substance Act Tracking) API on registration. Validation surfaces the buyer’s active Schedules + state of registration. Restricted SKUs hidden from catalog if registration is invalid, expired, or out-of-state. At checkout, Schedule II orders branch to a CSOS digital-signature flow (the buyer’s PKI cert from DEA), Schedule III-V orders generate a separate audit log entry.

State-by-state edge cases that bite:

• California, some compounded controlled drugs require separate CDPH veterinary food-animal drug retailer permit.
• New York, separate practitioner registration for controlled substances; the federal DEA number alone isn’t enough.
• Florida, telehealth carve-outs let some Schedule IV orders ship without an in-person visit; rules updated 2024.
• Texas, veterinary controlled-substance registration through the Texas Department of Public Safety, separate from DEA.

Monthly CSOS report runs on cron, exports to the DEA-mandated format. Mock audit once a quarter, real DEA audit roughly every 3 years for active wholesalers.